zeroshade commented on code in PR #1153:
URL: https://github.com/apache/arrow-go/pull/1153#discussion_r3761992213
##########
arrow/flight/flightsql/driver/utils.go:
##########
@@ -37,19 +37,17 @@ type grpcCredentials struct {
func (g grpcCredentials) GetRequestMetadata(ctx context.Context, uri
...string) (map[string]string, error) {
md := make(map[string]string, len(g.params)+1)
- // Authentication parameters
+ for k, v := range g.params {
Review Comment:
gRPC lowercases every key returned by `PerRPCCredentials` before sending it,
so a parameter named `Authorization` remains distinct in this map but later
collides with the configured lowercase `authorization`. Since both maps are
iterated, either value can win. An exact-head in-memory gRPC probe reproduced
this: the server received `Bearer attacker` on request 5. Please normalize
parameter keys before applying configured auth, or exclude `authorization`
case-insensitively, and add a mixed-case transport-level regression.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
